PT-2020-15175 · Apache · Apache Nifi

Jakub Palaczynski · Published 2020-01-28 · Updated 2025-09-12 · CVE-2020-1933

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.0.0 through 1.10.0

Description A XSS issue was found, allowing malicious scripts to be injected into the UI through actions by an unaware authenticated user, specifically in Firefox, with no occurrence in other browsers.

Recommendations For Apache NiFi versions 1.0.0 through 1.10.0, update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-NIFI-2020-1933

CVE-2020-1933

GHSA-PQHQ-XX62-2V2P

Affected Products

Apache Nifi

References · 7

• https://nifi.apache.org/security.html#CVE-2020-1933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1933 · Security Note
• https://osv.dev/vulnerability/GHSA-pqhq-xx62-2v2p · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2020-1933 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1933 · Vendor Advisory
• https://github.com/apache/nifi/pull/3991 · Note
• https://t.me/cvenotify/505 · Telegram Post